rule Linux_Gafgyt
{

// Tencent is pleased to support the open source community by making HaboMalHunter available.
// Copyright (C) 2017 THL A29 Limited, a Tencent company. All rights reserved.
// Licensed under the MIT License (the "License"); you may not use this file except in 
// compliance with the License. You may obtain a copy of the License at
// 
// http://opensource.org/licenses/MIT
// 
// Unless required by applicable law or agreed to in writing, software distributed under the 
// License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, 
// either express or implied. See the License for the specific language governing permissions 
// and limitations under the License.

    //Unix.Trojan.1;Engine:51-255,target:6;(0&1&2&3&4&5&6);25642e25642e25642e2564;50494e47;504f4e47;50524f42494e47;4b494c4c4154544b;4a554e4b;434e43
    meta:
        Author  = ""
        Date    = "2016/11/21"
        Description = "Linux/Gafgyt malware"
    strings:
        $s0 = "%d.%d.%d.%d"
        $s1 = "PING"
        $s2 = "PONG"
        $s3 = "PROBING"
        $s4 = "KILLATTK"
        $s5 = "JUNK"
        $s6 = "CNC"
        $elf = {7f 45 4c 46} // ELF header
    condition:
        $elf in (0..4) and all of ($s*)
}